Mock Medicare Audit: How an Outside Review Finds Your Weak Points Before CMS Does

Most providers learn about their documentation weaknesses the hard way: through denied claims, overpayment demands, or a contractor's findings letter. A mock Medicare audit offers a better alternative. It is an outside review designed to look at your claims and records the way a Medicare contractor would, so you can find and fix problems before CMS, a Recovery Audit Contractor, a Unified Program Integrity Contractor, or the HHS Office of Inspector General does.

HHS-OIG's General Compliance Program Guidance identifies risk assessment, auditing, and monitoring as a core element of an effective compliance program. A well-designed mock audit puts that element into practice. It tests documentation, coding, billing, and audit response processes, provides an objective measure of risk, and gives leadership a roadmap for improvement.

This article explains what a mock Medicare audit is, why outside reviews are valuable, how to choose what to audit, how sampling works, how records are reviewed, how to test ADR and site visit readiness, how to protect privilege, what to do with findings, and how to build mock audits into your compliance program. It is educational and does not replace legal or professional advice.

What Is a Mock Medicare Audit?

A mock Medicare audit is a structured review of a sample of claims and supporting records, performed using the same rules and standards that Medicare contractors apply. It may also test the organization's processes for responding to audits, such as ADR intake and site visit readiness.

A mock audit can be:

• Focused, reviewing a specific service or risk area.

• Comprehensive, reviewing a broad range of services or departments.

• Process-oriented, testing audit response workflows.

• Combined, reviewing claims and processes together.

Why Use an Outside Reviewer?

Internal audits are valuable, but outside reviews offer advantages:

• Objectivity. Outside reviewers are less likely to be influenced by internal assumptions or relationships.

• Fresh perspective. They may notice patterns that internal staff overlook.

• Specialized expertise. They often have experience with contractor review methods, specific services, and statistical sampling.

• Credibility. Leadership and boards may give more weight to independent findings.

• Capacity. Outside teams can conduct reviews without disrupting daily operations.

OIG's compliance guidance has long encouraged organizations to use both internal and external resources for auditing, and many organizations rotate between internal and external reviews.

Step 1: Define the Objectives

Before starting, decide what the mock audit should accomplish:

• Measure documentation and coding accuracy for high-risk services.

• Identify potential overpayments.

• Test readiness for contractor reviews.

• Evaluate a new service line or billing process.

• Validate corrective actions from prior audits.

• Prepare for a known upcoming review.

Clear objectives guide the scope, sample, and reporting.

Step 2: Choose What to Audit

The most valuable mock audits focus on areas where contractors are likely to look. Sources for identifying risk areas include:

PEPPER

The Program for Evaluating Payment Patterns Electronic Report provides facility-specific data on services vulnerable to improper payments. Target areas where your facility is a high outlier, or a low outlier for coding-focused areas, are strong candidates for review.

Comparative Billing Reports

CMS's Comparative Billing Reports compare individual providers' billing with peers for specific services. Outlier status suggests areas worth auditing.

OIG Priorities

OIG's audit and evaluation reports, featured topics, and work planning materials identify services OIG considers high risk.

Contractor Review Topics

Review your MAC's current medical review and TPE topics, approved RAC review topics, and SMRC projects for your service types.

CERT Data

CMS's CERT reports and supplemental improper payment data identify services with high national error rates.

Internal Data

Look at your own denial trends, appeal outcomes, billing changes, new services, high-volume or high-dollar services, and staff turnover in key areas.

Step 3: Design the Sample

Probe Samples

Many mock audits begin with a probe sample, such as a small number of claims per provider or service, to identify whether problems exist. Probe samples are useful for discovery but generally are not designed for estimating overpayments across a population.

Statistically Valid Samples

When the goal is to estimate the financial impact of errors, a statistically valid random sample is needed. CMS's Medicare Program Integrity Manual, Chapter 8, describes the steps contractors follow, including defining the universe and sampling frame, selecting a random sample, and estimating overpayments. OIG makes its RAT-STATS statistical software available for sampling.

If the results might be used for a self-disclosure, note that OIG's Health Care Fraud Self-Disclosure Protocol requires damages estimates based on either all affected claims or a statistically valid random sample of at least 100 claims, using the mean point estimate.

Sampling Considerations

• Define the universe clearly, such as all paid claims for a specific service during a defined period.

• Document the sampling method, random number source, and seed so the sample can be replicated.

• Consider stratification when claim amounts vary widely.

• Involve a qualified statistician for samples that may be used to estimate overpayments.

Step 4: Review Records the Way a Contractor Would

Use Contractor Standards

Reviewers should apply:

• The Social Security Act and Medicare regulations.

• National Coverage Determinations and Local Coverage Determinations.

• Medicare manuals, including the Program Integrity Manual's documentation and signature requirements.

• Coding guidelines.

• The rules in effect on the dates of service.

Use Qualified Reviewers

Use certified coders for coding issues and licensed clinicians for medical necessity and level-of-care issues, similar to contractor review staff.

Review What Contractors Review

For each claim, evaluate:

• Orders and referrals.

• Certifications and plans of care.

• Face-to-face encounter documentation.

• Progress notes and medical necessity documentation.

• Coding accuracy, including units and modifiers.

• Signatures and dates.

• Amendments and late entries.

• Signs of cloned or templated documentation.

• Proof of delivery and other service-specific requirements.

Document Findings Clearly

For each claim, record whether it was supported, the reason for any error, the applicable rule, and the potential financial impact.

Step 5: Test Audit Response Processes

A mock audit can also test how well the organization responds to contractor requests.

Mock ADR

Send a simulated ADR to the appropriate department and measure:

• How quickly the request is recognized and routed.

• Whether the deadline is calculated correctly.

• Whether complete records are assembled.

• Whether signature logs and attestations are handled correctly.

• Whether the packet is organized and submitted properly.

Mock Site Visit

Simulate an unannounced site visit to test:

• Front desk and leadership response.

• Verification of the visitor's identity.

• Communication with the compliance officer and counsel.

• Staff understanding of their rights and responsibilities.

• Ability to produce requested records.

Data and Systems Review

Test whether the EHR and billing systems can produce complete records, including audit logs, electronic signatures, and addenda.

Step 6: Protect Privilege When Appropriate

If the mock audit could reveal potential overpayments, fraud, or legal violations, consider having legal counsel engage the outside reviewer. When counsel directs the review to help provide legal advice, the results may be protected by attorney-client privilege or work product protections, depending on the circumstances and applicable law. Counsel can also advise on how to handle findings, including obligations under the 60-day overpayment rule.

For routine documentation readiness reviews where privilege is less important, a direct engagement may be appropriate. Decide before the review begins.

Step 7: Report Findings

A strong mock audit report includes:

• Objectives and scope.

• Sampling methodology.

• Review standards applied.

• Overall error rates by service, provider, and error type.

• Claim-level findings.

• Root cause analysis.

• Potential financial impact.

• Process findings from mock ADRs or site visits.

• Prioritized recommendations.

Present results to leadership and the compliance committee, and report key findings to the governing body as appropriate.

Step 8: Act on the Findings

Correct Root Causes

• Update EHR templates to prompt for required elements.

• Revise policies and procedures.

• Provide targeted education to clinicians, coders, and billing staff.

• Improve processes for obtaining orders, certifications, and signatures.

• Strengthen ADR intake and response workflows.

Address Potential Overpayments

If the mock audit identifies claims that were paid in error, the organization must evaluate its obligations under the 60-day overpayment rule at 42 CFR 401.305. The rule requires providers to report and return identified overpayments within the required timeframe, and it allows the deadline to be suspended for a timely, good-faith investigation to determine the full extent of related overpayments. Work with counsel to determine whether a broader review is needed, how to quantify the overpayment, and how to report and return it, whether through the MAC's voluntary refund process or a self-disclosure protocol in more serious cases.

Monitor Improvement

Conduct follow-up reviews to confirm that corrective actions are working.

Service-Specific Focus Areas

Different services carry different documentation risks. A mock audit should focus on the requirements that matter most for the services being reviewed. Common examples include:

Evaluation and Management Services

• Support for the level of service based on medical decision making or time.

• Documentation of time when time is used to select the level.

• Use of modifiers such as 25 for separately identifiable services.

• Split or shared visit rules in facility settings.

• Signs of cloned or copied documentation.

Inpatient Hospital Services

• Physician orders for inpatient admission.

• Support for the expectation of a stay crossing two midnights.

• Diagnosis coding and DRG assignment.

• Documentation supporting secondary diagnoses that affect payment.

Therapy Services

• Plans of care with required elements and timely certification.

• Documentation of skilled services and progress.

• Correct use of timed codes and units.

• Use of required modifiers.

Home Health

• Face-to-face encounter documentation related to the primary reason for home health.

• Homebound status.

• Need for skilled services.

• Signed and dated plans of care and certifications.

Durable Medical Equipment

• Valid orders with required elements.

• Medical record support for coverage criteria in the applicable LCD.

• Proof of delivery.

• Continued need and continued use for rentals and supplies.

Hospice

• Certifications of terminal illness and narrative statements.

• Face-to-face encounters for recertification when required.

• Documentation supporting a prognosis of six months or less.

• Level-of-care documentation, such as for general inpatient care.

Measuring Results Over Time

Mock audits are most valuable when results are tracked over time.

• Use consistent definitions of errors so results can be compared.

• Track error rates by service, provider, department, and error type.

• Compare results with national improper payment data from CERT, where relevant.

• Set improvement targets and report progress to the compliance committee.

• Track how quickly corrective actions are implemented.

• Monitor whether contractor reviews, denials, and appeal outcomes improve after corrective actions.

Involving Clinicians in the Process

Clinicians are central to documentation quality, so their engagement determines whether improvements stick.

• Share findings with clinicians in a constructive, educational way.

• Use real examples from the mock audit, with identifying information removed where appropriate.

• Explain why specific elements matter for coverage and payment.

• Ask clinicians for input on EHR template changes.

• Provide individual feedback for clinicians with higher error rates.

• Recognize improvement.

Common Findings in Mock Audits

Outside reviews often surface the same types of problems that contractors cite most frequently:

• Missing or illegible signatures, or signatures without a valid attestation or signature log.

• Missing orders, certifications, or plans of care.

• Documentation that does not support medical necessity for the specific service billed.

• Coding levels that are higher or lower than the documentation supports.

• Copied-forward notes that do not reflect the patient's condition on the date of service.

• Records that cannot be produced quickly or completely from the EHR.

Finding these issues internally gives the organization the chance to correct them before a contractor does.

Budgeting for a Mock Audit

Costs depend on the number of claims, the complexity of the services, the reviewers' qualifications, whether statistical sampling is used, and whether process testing is included. To manage cost:

• Start with a focused probe of the highest-risk area.

• Expand to a larger or statistically valid sample only when the probe shows problems.

• Combine claim reviews with process testing in a single engagement.

• Reuse sampling frames and review tools for follow-up audits.

Compared with the potential cost of extrapolated overpayments, prolonged prepayment review, or enforcement actions, a well-targeted mock audit is often a modest investment.

How Often to Conduct Mock Audits

There is no single required frequency. Many organizations:

• Conduct focused mock audits of high-risk areas annually.

• Review new services or providers within their first months.

• Perform follow-up reviews after corrective actions.

• Increase frequency when data shows outlier status or denials increase.

• Rotate topics to cover different services over time.

Choosing an Outside Reviewer

When selecting an outside firm for a mock audit, consider:

• Experience reviewing the specific services and provider type.

• Familiarity with how MACs, RACs, UPICs, the SMRC, and CERT conduct reviews.

• Credentials of the review team, such as certified coders, nurses, therapists, or physicians.

• Access to a qualified statistician when sampling will be used to estimate overpayments.

• Willingness to work under the direction of counsel when privilege is needed.

• Independence from the staff and processes being reviewed.

• A business associate agreement and strong data security practices under HIPAA.

• Clear deliverables, timelines, and fees.

A Mock Audit Checklist

• Define objectives and scope.

• Decide whether counsel will direct the review.

• Select risk areas using PEPPER, CBRs, OIG reports, and contractor topics.

• Define the universe and select the sample, documenting the method.

• Gather complete records for each sampled claim.

• Review claims against the coverage, coding, and documentation rules in effect on the dates of service.

• Record claim-level findings and financial impact.

• Test ADR intake and, if appropriate, site visit response.

• Analyze root causes.

• Report findings to leadership and the compliance committee.

• Evaluate 60-day overpayment obligations with counsel.

• Implement corrective actions and education.

• Schedule a follow-up review.

Common Mistakes

• Choosing topics without considering contractor and OIG priorities.

• Using samples that are too small or not random when estimating overpayments.

• Applying standards that differ from contractors' standards.

• Using reviewers without appropriate qualifications.

• Failing to test audit response processes.

• Not deciding whether privilege is needed before starting.

• Producing findings without root cause analysis.

• Ignoring 60-day overpayment obligations triggered by findings.

• Failing to follow up on corrective actions.

Benefits of Mock Audits

• Early identification of documentation and coding weaknesses.

• Reduced risk of denials and overpayments.

• Better preparedness for contractor reviews.

• Stronger appeal positions when reviews do occur.

• Evidence of an effective compliance program.

• Improved staff education and accountability.

• Data to support leadership decisions and resource allocation.

A Hypothetical Example

A home health agency notices in its PEPPER that it is a high outlier for a target area related to episode patterns. It engages an outside reviewer, through counsel, to conduct a mock audit of 60 episodes.

The reviewers apply Medicare home health requirements, including face-to-face encounter documentation, homebound status, skilled need, and plan of care requirements. They find that 18 percent of episodes have face-to-face encounter documentation that does not clearly relate to the primary reason for home health, and several plans of care lack timely signatures. A mock ADR also reveals that ADRs sent to a regional office were not routed promptly.

Under counsel's direction, the agency expands its review to quantify potential overpayments, reports and returns them, updates its intake process to verify face-to-face documentation, implements signature tracking, and centralizes ADR intake. Six months later, a follow-up review shows significant improvement. When the agency later receives a MAC TPE request, it passes the first round.

Frequently Asked Questions

What is a mock Medicare audit?

A structured review of a sample of claims and records using the same rules contractors apply, often combined with testing of audit response processes.

How do I decide what to audit?

Use PEPPER, Comparative Billing Reports, OIG priorities, MAC and RAC review topics, CERT data, and your own denial and billing data.

How many claims should be reviewed?

It depends on the objective. Probe samples can identify issues, while statistically valid samples are needed to estimate overpayments. OIG's Self-Disclosure Protocol requires at least 100 claims when sampling is used to estimate damages for a disclosure.

Should the mock audit be privileged?

If it could reveal potential overpayments or legal violations, consider having counsel engage the reviewer to help protect privilege.

What if the mock audit finds overpayments?

Evaluate your obligations under the 60-day overpayment rule, conduct a timely, good-faith investigation if needed, and report and return overpayments as required.

Conclusion

A mock Medicare audit lets providers see their claims and records through a contractor's eyes before an actual review occurs. By choosing high-risk topics, designing appropriate samples, applying contractor standards with qualified reviewers, testing audit response processes, protecting privilege when needed, and acting promptly on findings, providers can reduce denials and overpayments, strengthen their compliance programs, and enter real audits with confidence.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that conducts mock Medicare audits, including risk-based topic selection, sampling, documentation and coding reviews, mock ADR and site visit testing, root cause analysis, and corrective action planning. When privilege is important, we work under the direction of our clients' legal counsel. If you would like to find your weak points before CMS does, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure Protocol. https://oig.hhs.gov/compliance/self-disclosure-info/

• U.S. Department of Health and Human Services, Office of Inspector General. RAT-STATS Statistical Software. https://oig.hhs.gov/compliance/rat-stats/

• U.S. Department of Health and Human Services, Office of Inspector General. Reports and Publications. https://oig.hhs.gov/reports/all/

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-Research/monitoring-Programs/medicare-Fee-Service-Compliance-Programs

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for May 28, 2026 (PEPPER Relaunch for All Facility Types). https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-may-28-2026

• Centers for Medicare & Medicaid Services. Comprehensive Error Rate Testing (CERT). https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 8, Section 8.4, Statistical Sampling for Overpayment Estimation. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c08.pdf

• Centers for Medicare & Medicaid Services. Complying with Medical Record Documentation Requirements (MLN909160). https://www.hhs.gov/guidance/sites/default/files/hhs-guidance-documents/CMS/certmedrecdoc_factsheet_icn909160.pdf

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305